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Access to information held in 
complaint files 


Introduction 


The Freedom of Information Act 2000 (FOIA) and the Environmental 
Information Regulations 2004 (EIR) give the public rights to access 
information held by public authorities. 


An overview of the main provisions of FOIA and the EIR can be 
found in The Guide to Freedom of Information and The Guide to the 


Environmental Information Regulations. 


This is part of a series of guidance, which goes into more detail than 
the guides, to help public authorities to fully understand their 
obligations and promote good practice. 


This guidance explains in more detail how to apply FOIA exemptions 
and EIR exceptions relating to personal data. It therefore refers to 
the processing of personal data in accordance with the UK General 
Data Protection Regulation (UK GDPR) and the Data Protection Act 
2018 (DPA). It is a guide to our general recommended approach, 
although decisions will always be made on a case by case basis. 


The DPA and UK GDPR set out the UK data protection regime. The 
DPA also sets out separate data protection rules for the processing 
of personal data by competent authorities’ for law enforcement 
purposes (DPA Part 3); and for processing by the intelligence 
services (DPA Part 4). For more information see our Guide to Data 
Protection. 


This guidance is based on precedents established under the Data 
Protection Act 1998 (DPA98). It will be regularly reviewed and kept 


1 A competent authority for the purposes of law enforcement means a 


person specified in Schedule 7 of the DPA and any other person if, and to the 
extent that, the person has statutory functions to exercise public authority or 
public powers for the law enforcement purposes. 
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in line with new decisions of the Information Commissioner, 
tribunals and courts. Additional guidance is available on our guidance 
pages. 


This guidance 


This guidance is to help you to deal with requests for information 
which involve access to personal data held in complaint files. 


It covers what you should do when an individual makes a subject 
access request under the UK GDPR and the DPA for access to their 
own personal data in a complaint file. 


It also deals with the issues that arise when an individual asks you 
for access to personal data held about somebody else in a complaint 
file under either FOIA or the EIR. 


This guidance will help you to decide: 


e whether information in a complaint file is personal data, and if 
so whose personal data it is; 


e who gets access to which data when you receive a data 
protection subject access request from one of the parties 
whose personal data is contained in a complaint file; and 


e how you should deal with personal data held in a complaint 
file when you receive a freedom of information (FOI) or EIR 
request for that file. 


The guidance focuses on whether information is personal data and if 
so, whether you should disclose it to a third party. 


It looks at the sort of requests you may have to deal with in 
practice. It avoids detailed legal exposition but analyses the content 
of some typical complaint files to help you understand the law and 
deal properly with access requests. 


This guidance does not address all the other FOI or DPA exemptions 
that might be relevant when someone makes a request for access 
to the information contained in a complaint file. For further 
information, see our FOI guidance to exemptions and our UK 
GDPR guidance on exemptions. 


For further information, please our guidance What is personal data? 
and Personal information (section 40 and regulation 13). 
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Some basics 


Under the UK GDPR and the DPA, individuals have a right to access 
information about themselves. This is commonly known as subject 
access. It does not give an individual the right of access to 
information about another person - unless they are acting on behalf 
of someone else, for example a parent acting on behalf of a child. 
The UK GDPR and the DPA apply to all organisations that 

process personal data - public or private sector. 


Remember you must handle a request for the requester’s personal 
data as a subject access request under the UK GDPR or the DPA, 
as applicable. Further information about how to deal with a 
subject access request is available in our UK GDPR guidance Right 
of access and in our law enforcement guidance The right of 
access. 


In most cases you will handle a subject access request under the UK 
GDPR (as general processing) and may refer to the DPA for relevant 
exemptions. However, if an individual makes a subject access 
request for personal data which you are processing for law 
enforcement purposes, you need to handle this entirely under Part 3 
of the DPA. Likewise, you should handle a subject access request 
which falls under intelligence services processing under Part 4 of the 
DPA. 


There is separate guidance to law enforcement processing. 


Under FOIA, any individual can make a request for access to any 
information held by a public authority. However, an individual’s own 
personal data is exempt from FOIA’s access right - and you must 
deal with it according to data protection subject access rules. 
Potentially, FOIA does give one individual a right of access to 
information about another person. However, in most cases, you 
have to decide whether providing the third party information 
contravenes the data protection principles and therefore if this data 
is exempt from disclosure. 


Because FOIA only applies to public authorities, individuals normally 
have no right of access to third party personal data held by private 
sector organisations. 
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How to approach a complaint file 


Complaint files can be complex, often consisting of various 
elements: 


e the complainant’s personal data; 

e third party personal data; 

e amix of the complainant’s data and the third party data which 
is inextricably linked and cannot be separated; and 

e information that is not personal data at all. 


This means that sometimes you need to consider each document 
within a complaint file separately, and even the content of particular 
documents, to assess the status of the information they contain. 


However, you may be able to take a more high-level approach. You 
could make an informed decision by looking at a file’s index and 
using your experience about the sort of information a file, section of 
a file or document is likely to contain, rather than looking at every 
line of every document. 


If you have good information management procedures in place, this 
will make it easier for you to deal with either data protection or 
freedom of information access requests. For example, you will find 
it easier to deal with requests to locate personal data, to decide 
whose personal data it is and to make decisions about its disclosure, 
if you have reliable indexes, contents pages, descriptions of 
documents and metadata. You may be able to establish a routine 
for dealing with the same sorts of requests when they are made for 
information in the same sorts of file. 


Being helpful to the public versus legal requirement 


It is good practice for you to be as helpful as possible to individuals 
who make access requests. 


It can also often be easier to give an applicant a mixture of all the 
personal data and ordinary information relevant to their request, 
rather than to look at every document in a file to decide whether or 
not it is their personal data. This is a feasible way to progress a 
case where none of the information is particularly sensitive or 
contentious. For example, a file relating to a customer’s complaint 
about a routine consumer protection issue. 
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However, you should be clear about the approach you take to deal 
with access requests. In particular, if you recommend that you will 
provide information to the applicant on a discretionary basis, you 
should be clear that you are under no legal obligation to provide it. 
Individuals have no right of appeal to the ICO or Information 
Tribunal in respect of information that they have no legal right of 
access to and providing the information on a discretionary basis 
does not mean that it becomes the applicant’s personal data. 


The limits of personal data within a complaint file 


Typically, a complaint file will start off at the more ‘personal’ end of 
the spectrum - an exchange of personal views about an issue or 
something that has happened. As an investigation progresses, more 
general information may be included in the file. For example, your 
organisation’s policies and procedures or geographical information 
about the place where an accident took place. The latter information 
may not be personal data, even though it is contained in a 
complainant’s file and may be relevant to the complaint. It is 
important to be able to detect any ‘cut-off’ points, at which 
information within a complaint file ceases to be personal data and 
becomes ordinary, non-personal information. 


See document 1 below - the first three bullet points are about a 
particular individual’s behaviour. However, the fourth point - though 
a related one - is about the relationship between one organisation 
and another and is not ‘personal’ at all. 


Document 1 — extract from minutes of internal meeting: 


Weekly case review meeting 


Attendees: Joey Jacobs (JJ), George Lemon (GL), Sabina Patel 
(Sie) We ichise Mme ois @ ileum KeS)) 


Relve meee: 
Agenda item 7 - Long Lane complaint 
1.GL confirmed that two visits had now been made to Long 
Lane following a complaint about Peter Abalone by a 


neighbour and initial investigation indicating a 
Significant problem. 
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2. JJ summarised original complaint and said what he saw 
when he visited Long Lane. Explained that in his view 
there had been no real improvement in the situation 
despite warnings and would not be. KS confirmed no 
previous complaints relating to the property and 
suggested it was worth making further attempts at 
resolution, especially considering Mr Abalone’s 
possible health issues. 


3. SP raised concern about level of risk from amount of 
glass in the street. GL confirmed arrangements had been 
made to remove. First stage formal warning will be 
issued and then situation to be monitored. Will be 
reviewed at next meeting. 


4. GL explained that the Long Lane case highlights the 
need to chase-up the application for a regional ‘clean- 
up’ grant that SP had submitted to the Regional 
Rejuvenation Agency in October last year. SP provided 
an update and explained that due to a cut in the RRA’s 
own funding, it was unlikely any clear-up grant would 
be forthcoming. 


Is everything in a complaint file the complainant’s 
personal data? 


The short answer is ‘no’. For information to be personal data it must 
relate to an individual and allow an individual to be identified 
from it - not all the information in a file will do this. However, the 
context in which information is held, and the way it is used, can 
have a bearing on whether it relates to an individual and therefore 
whether it can be the individual’s personal data. Even if information 
is used to inform a decision about someone, this does not 
necessarily mean that the information is personal data. 


For example, a company’s corporate policy might be used to inform 
a decision about whether to continue an individual’s employment, 
but this does not mean the policy is, or becomes, the employee’s 
personal data. For further information, please see our guidance on 


What is personal data? 


Document 2 below is about legal advice written by a company 
lawyer. 
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Originally the advice related to the various issues the lawyer had 
given advice about. At that stage it was not about the lawyer 
himself, and he was certainly not the subject of it. Later on, the 
lawyer’s manager collated all the advice the lawyer had given in a 
file about him, because she was concerned about the standard of 
the advice being given. At this point, the focus of the information 
changed from the issues the lawyer has dealt with, to the lawyer 
himself - the collection of information started to relate to him. In 
addition, the lawyer is identified as the author of the advice, it 
records his personal opinions and therefore it has become his 
personal data. 


Document 2 - extract from legal advice by the company’s 
solicitor: 


The behaviour of our delivery man, Mr Stevens, could certainly leave the 
company open to legal action should Mr O’Dwyer decide to pursue the matter 
through the courts. Although Mr Stevens’ actions may not amount to an actual 
assault, the courts could still award Mr O’Dwyer considerable compensation 
for the anxiety and distress that seems to have been caused, and for his 
inconvenience in that we failed to install the washing machine when we were 
contracted to do so. 

I note that Mr Stevens has a bit of a ‘history’ since he joined us. My advice 
would be to offer to settle out of court and to sort out his washing machine 
ASAP. We can discuss the numbers once we have contacted Mr O’Dwyer again 
to assess his intentions. I’ll defer to HR on the Stevens situation. 


Maurice Carpentier, Company Solicitor. 


Some information in a complaint file will never be personal data, 
regardless of the context it is held in and the way it is used - even 
if it is used in a way that affects an individual. For example, the 
company’s disciplinary policy contains general corporate rules and 
procedures. It does not identify the lawyer (or anyone else). 
However, it cannot relate to the lawyer either, in the way that his 
legal advice does. Therefore the disciplinary procedure is not the 
lawyer’s personal data, even if it is held in a disciplinary file about 
him and is used to inform decisions that affect him. 


Remember that Article 12(1) of the UK GDPR states that the 
controller should communicate with the data subject in a concise, 
transparent, intelligible and easily accessible form, using clear and 
plain language. If, for example, a document in the company’s 
disciplinary file says that action is being taken against Mr Carpentier 
under section 4-1-3 of its code of corporate conduct, the company 
needs 
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to explain the meaning of this section of the code. It might do this 
by explaining what section 4-1-3 says, or by providing a copy of 
that part of the code, or even the whole code of conduct. 


Are somebody’s opinions their personal data? 


Complaint files often contain information recording an individual’s 
opinion. For example a probation officer’s opinion of whether a 
client is likely to re-offend or a housing department executive’s 
opinion of a new government proposal to offer increased funding for 
the demolition of ‘slum’ housing. 


It can be difficult to determine whether an opinion relates to: 


e the individual who holds it; 
e the individual or issue the opinion is related to; or 
e both. 


However, for an opinion to be personal data it must both identify 
an individual and relate to him or her. 


It is usually easy to determine whether the individual who holds the 
opinion is identified or not. For example, a probation officer’s report 
will usually be signed and the minutes of a Housing Committee 
meeting will usually record the name of the housing department 
executive who gave their opinion of the government’s proposal. 


It can be more difficult to determine whether an opinion relates to 
the individual holding it. This can call for careful judgement based 
on the nature of the information, the context in which it is held and 
the purpose for which it is used. 


The following questions may help you decide whether 
information recording an individual’s opinion is their personal 
data: 


e Does the opinion tell you anything significant about the 
individual holding the opinion - for example 
biographical details, characteristics or their personal 
beliefs? 


e Just how ‘personal’ is the opinion? Is it a subjective, 
personal view rather than a professional, objective 
appraisal of an individual or issue? 
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e Is the opinion being used, or could it be used, to find 
out something about the individual holding the opinion, 
to treat him or her in a certain way or to inform a 
decision in respect of him or her? 


If the answer to any of these questions is ‘yes’ then the 
opinion is likely to be the personal data of the individual 
holding it. 


If the answer is ‘no’, then the opinion is unlikely to be the 
personal data of the individual holding it — of course it could 
be the personal data of the individual the opinion is about. 


In the case of the probation officer’s report below, the first 
paragraph of the report is only the personal data of his client; it 
identifies the client and the information recounts her previous 
behaviour and her current status. Although the opinion expressed is 
clearly that of her probation officer, the information does not reveal 
anything substantive about the probation officer’s own 
characteristics or behaviour. The client is the subject of the 
information, not the probation officer. It is possible to infer 
information about the probation officer from his opinion — for 
example that he is a probation officer and works with that particular 
client. However, this does not mean that this part of the probation 
officer’s opinion is his personal data. 


“Gail Wallis has been in contact with our agency since her release from 
HMWP Livenham on 21 October 2017. She is currently subject to a Good 
Behaviour Contract agreement that is due to expire in October 2021. She 
has a case-worker at her local Substance Dependency Support Unit and is 
required under her Contract to attend the Unit weekly.” 


However, the probation officer’s report goes on to say the following: 


“ Given my 15 years’ experience of dealing with clients like this, including 
my management of those on drug rehabilitation programmes, | am happy 
to conclude that my client no longer poses a threat to herself or to those 
around her and is unlikely to reoffend - provided access to the necessary 
support services is in place. My own approach is always to give clients the 
benefit of the doubt in cases like this, and usually this has worked out to the 
client's and the department's satisfaction. 

Idries Thesiger — Issues Resolution Officer.” 
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This part of the report does tell us something about the probation 
officer himself - his professional approach and work history. This 
part of the report is, therefore, the probation officer’s own personal 
data. 


Similar considerations apply in the case of the housing department 
executive. The minutes of the meeting may merely record the 
following: 


“Ms Morrissey reported that 85% of the housing stock in the Seedham Road 
estate in Stevenham was built before 1895. 47% of the properties the LA 
has surveyed lack basic amenities and are in severe disrepair. Ms 
Morrissey’s expressed her opinion that we should take advantage of the 
government's new funding offer and demolish the estate ASAP.” 


Although this information reveals Irina Morrissey’s professional 
opinion of the housing issue, it reveals nothing of Ms Morrissey’s 
own characteristics, behaviour or personal beliefs. Her opinion 
relates to the Seedham Road estate, not to her. 


The situation would be different if the minutes of the meeting did 
record information that relates to Ms Morrissey’s personal beliefs, 
for example. The minutes might record the following: 


“Ms Morrissey then expressed her opinion that given the sort of people who 
live in the estate, and their record of criminality and anti-social behaviour, 
it would be better off if we bull-dozed the place and didn’t bother re- 
housing its occupants.” 


This opinion clearly reveals something about Ms Morrissey herself - 
it relates to her attitudes, state of mind and possibly her political 
beliefs. It is therefore Ms Morrissey’s personal data. The situation 
would be even clearer if Ms Morrissey’s employer were to collate 
records of her outbursts from the minutes of the various meetings 
she has spoken at with a view to taking action against her under its 
Equality and Diversity policy. 


We recognise that this is a difficult area and it calls for careful 
judgement - there is not always an obvious answer. One factor that 
might favour the disclosure of recorded opinions to the individual 
who held the opinion is that they will already know the content of 
the information because they gave the opinion in the first place. 
However, this does not mean that the opinion is necessarily their 
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personal data, or that you can necessarily withhold the opinion on 
data protection grounds if there is an FOI request for access to it. 


Can more than one person be the subject of personal data? 


Yes, information can have more than one person as its subject. An 
obvious example is a witness statement. It says who the witness is, 
records their whereabouts and typically details what the witness 
saw another person do or say. Normally, both the witness and the 
other person are identified in the statement. Although a witness 
statement is primarily about the witness (where they were, what 
they saw etc.), it also identifies and relates to the other person 
because it says what the witness saw them do, heard them say etc. 
Therefore information like this can be personal data about two (or 
more) people. See document 3 below. 


Document 3 — witness statement: 


Note of preliminary conversation between Mrs Wainwright, 
Staff/Pupil Liaison Officer, and David Tang, Year 10 pupil. 


I spoke to David Tang about his experiences at hockey 
practice sessions. In particular I explored his recollection 
of last Thursday’s hockey practice. David said that Mr Boon 
was ‘getting stroppy’ with the team as they have not been 
very successful in recent weeks. He said that Mr Boon had 
‘gone off the deep end’ with James Monk last week. 


David said that he was aware that James Monk’s parents have 
complained about Mr Boon. David gave me an account of the 
incident in question. I asked David if anyone else witnessed 
this incident bwt ne saic! that ne cicon tnink ©- I 
discussed the school’s procedures for investigating 
complaints with David, and tried to impress upon him the 
importance of telling the truth and sticking to the facts of 
the matter as he recalls them. I asked David if he would be 
willing to write down his version of last Thursday’s events: 


2. David Tang’s written account of incident between Mr Boon 
and James Monk: 


Mr Boon was on everybody’s case at last week’s hockey 
practice. He was shouting at everyone all the time. He was 
especially picking on me and James Monk. 


We were having a game at the end of practice and Mr Boon 
kept picking on me and James. James missed a shot at goal 
towards the end of the game. When we were walking off the 
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field Mr Boon told him that he was a horrible little loser 
and that he didn’t deserve to attend this school. 
remembered the words clearly because he’d said the same 
thing to me at last week’s practice. I think he’s a horrid 
lou Ly. 


Third party personal data 


Both the DPA and FOIA/EIR have mechanisms for dealing with 
situations where one individual makes a request but the personal 
data of another individual falls within its scope. 


In practice, the effect of applying either the DPA or FOIA/EIR 
disclosure tests to third party personal data is likely to be the same. 
It is best to make sure, though, that you cite the correct statutory 
language when dealing with a case. 


In FOIA and the EIR, the most common test for the disclosure of 
third party personal data is whether this would breach the data 
protection principles. 


However, the DPA itself works slightly differently to FOIA and the 
EIR, and there are data protection exemptions you must consider 
when deciding whether to disclose third party data in response to a 
subject access request. Which data protection exemption applies 
depends on the nature of the data and the reasons you are 
processing it: 


Type of Exemptions for third- | Test for disclosure 

Personal data | party personal data 

processed under the subject (See exemption 

access right for full details) 

General Schedule 2 Part 3 (a) has the third 
processing paragraph 16(1) of the | party consented to 
under the UK DPA. the disclosure? 
GDPR 


(b) is it reasonable in 
the circumstances to 
disclose the third- 
party data without 
their consent? 
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Processing for Part 3 Chapter 3 Is it a necessary and 
law enforcement | Section 45(4)(e) of the | proportionate 
purposes (under | DPA. measure to refuse 
DPA Part 3) disclosure in order to 
protect the rights and 
freedoms of others? 


Intelligence Part 4 Chapter 3 (a) has the third 


services section 94(6) of the party consented to 
processing DPA. the disclosure? 


(under DPA Part 
4) (b) is it reasonable in 


the circumstances to 
disclose the third- 
party data without 
their consent? 


If the other person consents to you disclosing the information about 
them, then it is reasonable to do so. However, if there is no such 
consent, you must decide whether to disclose the information 
anyway and if this would be reasonable. When making this 
judgement, you must consider all the relevant circumstances. 


This usually involves considering: 


e the reasonable expectations of the other person and in 
particular, any duty of confidentiality owed to them; 


e any express refusal of consent by the other individual and 
whether they are capable of giving consent; 


e the type of information that would be disclosed; and 


e ina work context, factors such as an individual’s seniority and 
role. In general, it is more likely to be reasonable to disclose 
information about an employee acting in a professional 
Capacity than about a private citizen. 


For further information about responding to an FOI request for third 
party data, see our guidance Personal information (section 40 and 
regulation 13). For information about responding to a subject 
access request which includes third party data, see our UK GDPR 
guidance Right of access and our law enforcement guidance The 


right of access. 
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For further information about FOI and data protection requests for 
personal data and third party data see also our guidance Personal 


data of both the requester and others. 


Case study 1 
A complaint file held by a supermarket about the 
behaviour of a delivery man 


Extract from the complainant’s letter about the delivery man’s 
behaviour: 


Mr B O’Dwyer 
47 Catkin Street 
Livenham 

LV6 7H8 


Dear Sir, 


I was having a washing machine delivered last Monday (6 January) but 
one of the delivery men - his colleague informed me that he’s called 
Noel Stevens - started to go crazy because I wanted him to bring the 
machine through the garden and through my back door, rather than 
through the house. When I told him I wasn’t prepared to move the 
furniture in my hall, he literally started to jump and down, swearing 
and threatening to hit me. He told me what I could do with my washing 
machine and left it in the middle of the road. I have been suffering 
from severe stress following an accident 2 years ago and this has made 
it worse. I want to know what you intend to do about this. 


Note added by supermarket: sure we had similar complaint from same 
guy few years ago about a cooker - can Complaints Dept. check files 
pls? 


Is it personal data? 


e We can assume that this letter is kept in a complaint file listed 
under Mr O’Dwyer’s name and that all the information in the 
file is relevant to his complaint. However, this does not mean 
that the entire content of the file is necessarily Mr O’Dwyer’s 
personal data. 

e All of the information in the letter relates to Mr O’Dwyer, 
because it describes the incident he was involved in and his 
feelings about it. Mr O'Dwyer is clearly identified in relation 
to the information. The information in this letter is therefore 
Mr O’Dwyer’s personal data. 
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e Mr O'Dwyer is the subject of the personal data in the letter. 
This means that he is its data subject and has a right of 
subject access to that information, unless an exemption 


applies. Note that Mr O’Dwyer may not be the only subject of 
the personal data. 

e Some of the letter - highlighted in red - identifies Mr Stevens 
and relates to his behaviour. This is therefore personal data 
about Mr Stevens and he may have a right of subject access 
to this part of Mr O’Dwyer’s letter. 

e Remember that information is not necessarily the personal 
data of just one person. In cases like this, where one person 
is complaining about another, the information is usually 
personal data that relates to both the complainant and the 
person being complained about, and both have subject access 
rights. The supermarket must use the DPA test of 
reasonableness to decide whether they can release the 
personal data. 


If Mr O’Dwyer makes a subject access request: 


e The supermarket should provide him with a copy of the whole 
letter, even though it contains some information that is also 
personal data about Mr Stevens. As Mr O’Dwyer wrote the 
letter and already knows what it says about Mr Stevens, it is 
reasonable in the circumstances to provide Mr O’Dwyer with 
the whole letter. 

e Mr O’Dwyer should also get the comments that the 
supermarket’s investigator wrote on the letter because they 
relate to him and state the supermarket’s intentions towards 
him — ie to check whether he has made any similar complaints 
in the past. 


If Mr Stevens makes a subject access request: 


e The letter contains some information that relates to, and 
identifies, Mr Stevens. This means that he is the subject of 
the personal data in this part of the letter, and the 
supermarket should provide it to him. In practice, this means 
the supermarket should provide a redacted version of the 
letter, or an extract from it ie the section of the letter 
highlighted - unless an exemption applies. 


If a third party makes a freedom of information request: 


The supermarket is not a public authority so FOI rights do not 
apply. 
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Witness statement from the complainant’s neighbour: 


Mrs P Oddman 
45 Catkin Street 
Livenham 

LV6 7H8 


Dear sir, 


My neighbour, Bernard O’Dwyer, has asked me to write to you about 
what I saw last Monday. I was washing my front windows when I 
noticed that my neighbour was having a washing machine delivered. I 
don’t know why but one of the delivery men seemed to get very 
agitated and started behaving really threateningly towards Mr O’Dwyer. 
I have never seen anything like it. Although Mr O’Dwyer tried to calm 
him down, in the end the delivery man drove off at high speed, leaving 
the washing machine and his colleague standing in the street. 


Is it personal data? 


e The information in the letter is the personal data of Mrs 
Oddman because it identifies her, relates to her whereabouts 
and actions and contains her account of the incident. 

e The letter also contains the personal data of Mr O'Dwyer 
because it identifies him and details his behaviour. Although 
Mrs Oddman’s letter does not name the delivery man, the 
information about him — highlighted in red - is personal data 
in the hands of the supermarket because it holds the other 
information needed - both in the complaint files and in 
sources such as delivery schedules - to identify Mr Stevens. 

e A witness statement might be less explicit in terms of the 
identification and observation of another individual. For 
example, Mrs Oddman’s statement might have said that she 
hadn't seen anyone doing anything. In this case the 
information in the statement is Mrs Oddman’s personal data 
but not Mr Stevens’ - even though it is held in a file about 
him. 


If Mrs Oddman makes a subject access request: 


e The supermarket should provide Mrs Oddman with a copy of 
the whole letter, even though some of it is also personal data 
about Mr O’Dwyer and Mr Stevens. 
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If Mr O’Dwyer makes a subject access request: 


e Mrs Oddman’s letter contains Mr O’Dwyer’s personal data. It 
is reasonable for the supermarket to provide Mr O’Dwyer with 
a copy of the personal data about him contained in Mrs 
Oddman’s letter. Mrs Oddman says that the complainant 
asked her to write to the supermarket and it is likely that Mr 
O’Dwyer is aware of the content of the letter. If in doubt, the 
Supermarket could ask the witness for her consent to provide 
a copy of her letter to Mr O’Dwyer. 


If Mr Stevens makes a subject access request: 


e Much of Mrs Oddman’s letter constitutes personal data about 
Mr Stevens - where she describes his behaviour (highlighted 
in red). This means that Mr Stevens does have subject access 
rights for that part of Mrs Oddman’s letter. 

e However it is not reasonable in the circumstances for the 
supermarket to provide Mr Stevens with a copy of the 
personal data about him contained in Mrs Oddman’s letter. 
This is because, given the nature of the incident, it is likely 
that the witness expects her letter to be held in confidence by 
the supermarket. It is therefore unreasonable to disclose any 
of Mrs Oddman’s letter to Mr Stevens. The supermarket could 
seek Mrs Oddman’s consent to disclose all, or part, of her 
letter to Mr Stevens. 


Summary of other complaints about the delivery man extracted 
from his personnel file: 


N Stevens Deliveries Department - Employee no.57689391 
Summary of previous complaint activity. 


e 16-9-2016: Complaint: dropped chest freezer down cellar 
steps and threatened householder 

e 4-4-2017: Complaint: abusive behaviour whilst 
delivering toaster 


e 6-1-2018: Complaint: abusive and threatening behaviour 
and failure to install washing machine 


Is it personal data? 


This is personal data about Mr Stevens because it identifies him and 
relates to his behaviour. 
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If Mr Stevens makes a subject access request: 


e The supermarket should provide him with a copy of this 
information. The information is exclusively about Mr Stevens. 
Even if the information is held in a file about Mr O’Dwyer’s 
complaint, it is not Mr O’Dwyer’s personal data because it 
neither identifies nor relates to Mr O’Dwyer. (In reality this 
information would also be held in Mr Stevens’ personnel file.) 


If Mr O’Dwyer, Mrs Oddman or any other third party makes a 
subject access request: 


e If Mr O’Dwyer makes a subject access request for all the 
information the supermarket holds about him, they should not 
provide him with information about other complaints made 
about Mr Stevens. Even though the information is held in a 
file about Mr O’Dwyer’s complaint, and may be relevant to it, 
it is personal data about Mr Stevens and not Mr O'Dwyer. 


Extract from legal advice by the company’s solicitor: 


The behaviour of our delivery man, Mr Stevens, could certainly leave the 
company open to legal action should Mr O'Dwyer decide to pursue the 
matter through the courts. Although Mr Stevens’ actions may not amount 
to an actual assault, the courts could still award Mr O'Dwyer considerable 
compensation for the anxiety and distress that seems to have been 
caused, and for his inconvenience in that we failed to install the washing 
machine when we were contracted to do so. 


| note that Mr Stevens has a bit of a ‘history’ since he joined us. My advice 
would be to offer to settle out of court and to sort out his washing machine 
ASAP. We can discuss the numbers once we have contacted Mr O'Dwyer 
again to assess his intentions. I'll defer to HR on the Stevens situation. 


Maurice Carpentier, Company Solicitor. 


Is it personal data? 


e This information identifies three people, but this does not 
necessarily mean that the legal advice is the personal data of 
all, or any, of the individuals named. To establish whether the 
information is personal data, and if so whose, the 
supermarket must consider which individual, or individuals, 
the information relates to. 
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If Mr Carpentier makes a subject access request: 


e Mr Carpentier has no right of subject access to the legal 
advice because even though he is identified as its author, the 
legal advice relates to Mr O'Dwyer and his complaint - 
nothing in the legal advice relates to Mr Carpentier and he 
certainly is not the subject of it. 

e Mr Carpentier’s legal advice does contain his name and job 
title. This is his personal data and the supermarket should 
provide it to him. However we would not expect the 
supermarket to provide ‘Maurice Carpentier, Company 
Solicitor’ more than once, even if it appears on various 
documents he has authored. 

e Please note that later on the supermarket may decide to 
collate a file of the poor legal advice Mr Carpentier has been 
giving, with a view to taking disciplinary action against him. If 
this happens the legal advice itself would become Mr 
Carpentier’s personal data because the focus of the 
information would become Mr Carpentier’s own professional 
competence, rather than the various topics and people his 
legal advice is about. 


If Mr O'Dwyer makes a subject access request: 


e The information relates to Mr O’Dwyer and his complaint. In 
particular it sets out the company’s intentions about Mr 
O’Dwyer, should he make a claim against them. This means 
that the information is Mr O’Dwyer’s personal data - although 
the information may be exempt from subject access on the 
grounds of legal professional privilege. 

e Leaving aside legal professional privilege, it is not reasonable 
in the circumstances to disclose personal data about Mr 
Stevens contained in the legal advice to Mr O'Dwyer - 
particularly that he has a ‘history’ with the company and that 
HR may act against him. It is reasonable to provide Mr 
Stevens’ personal data to Mr O’Dwyer in so far as it consists 
of information that Mr O’Dwyer is already aware of. However, 
the legal advice consists of the supermarket’s internal 
considerations and calculations and some of it is not personal 
data. 


If Mr Stevens makes a subject access request: 


e The legal advice identifies Mr Stevens and much of it relates 
to him. This is Mr Stevens’ personal data. He is entitled to this 
under subject access unless an exemption, for example legal 
professional privilege, applies. 
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Supermarket policies and procedures 


Complaints procedure 
Start Conduct jpoliley 
‘Our customer care charter’ 


Is it personal data? 


These documents contain the supermarket’s general policies 
and procedures. They are relevant to the incident in question 
because the supermarket may use them to decide whether to 
take any action against Mr Stevens, and perhaps to assess 
whether to offer Mr O’Dwyer’s compensation. However, even 
though these documents are held in Mr O’Dwyer’s complaint 
file they do not identify any individual or relate to any 
individual. Therefore they cannot constitute personal data and 
no one has a right of subject access to them. However, it 
might be reasonable for the supermarket to provide copies of 
these documents to Mr O’Dwyer or the other individuals 
involved in this matter, because they contain relevant 
background information. However, the supermarket is under 
no legal obligation to do so. 
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Case study 2 


A local authority’s investigation file into Mrs Belshaw’s 
complaint about the state of her neighbour’s property. 


. Livenham County Council site visit report 


Report prepared by: Joey Jacobs 

Address/ location visited: 2 Long Street, Livenham 

Reason for visit: Report by neighbour at no.4, Mrs Belshaw, of persistent mess in drive 
and into road from cans and bottles. 

Date and time of visit: 15 January 14:00 


Report: When I arrived at the premises a large quantity of cans and beer bottles were 
covering most of the drive of 2 Long Street. There was no recycling box visible and the 
black bin was already overflowing with rubbish bags. Approximately 20 cans had spilt 
onto the pavement and there were a large number of broken bottles on the pavement and in 
the gutter. 


The occupant, Mr Abalone, was at home and explained that he had never been given a 
recycling box by the Council. He said he had been having a clear out and was planning to 
take the rubbish to the tip himself but his car was in the garage, which was inaccessible 
because of the rubbish. He also explained that he is being treated for depression and is in 
no position at the moment to clear the mess up. He did seem a bit under the weather. 


I confirmed that the Council had received a complaint about the mess and explained 
consequences of not taking action to clear it up. Told Mr Abalone because of the scale of 
the problem we would visit again in a week and expected it to be cleared. I would order a 
new box for him. I left my business card with him so he can contact me. 


Follow up action: 


e Replacement recycling box to be ordered — confirmed 17/01 
e Follow up site visit TBC — [file note — In area 23/01 visit arranged PM] 


. Internal email between Council staff 


From: Joey.Jacobs@livenhamcouncil.gov.uk 
To: Mihaila.Stari@livehnamcouncil.gov.uk 


Subject: Site visit to Long Street ~ litter problem 
Mihaila, 


As discussed on the phone I went to Long Street last week 
and I have spoken to Mr Abalone at number 2. The outside of 
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the property is a mess and there is a lot of glass on the 
street. I’ve given Mr Abalone a week to clear it up but I 
don’t think it’s likely he’ll do it. I am in the area again 
on the 2974 s0 I’11 have another look but will let you know 
if I need you to make other arrangements to get it cleared 
up or there is any further action we need to take. 


Thanks 


Joey 


Is it personal data? 


e Both these documents contain Mr Abalone’s personal data 
because much of their content identifies him and relates to 
him, detailing his behaviour, describing his reaction to the 
accusation against him and setting out the authority’s 
intentions towards him. 


e The first of these documents contains some personal data 
about Mrs Belshaw - she is named in the document and it 
tells us that she has made a complaint (highlighted in green) 
- this part of the document identifies her and relates to her. 


e Information contained in these documents that identifies the 
authority’s two officials and details their activities, 
whereabouts, intentions and thoughts is personal data about 
them. However, not all the information in the documents is 
personal data about the officials. For example, the paragraph 
highlighted in red in the first document relates exclusively to 
Mr Abalone and is his personal data, it does not relate to the 
council officials and is not therefore their personal data. 


If Mr Abalone makes a subject access request: 


e We have established that most of the information in the 
documents is personal data about Mr Abalone, and he has a 
right of subject access to it, unless an exemption applies. 


e If the local authority owes a duty of confidentiality to an 
individual, they should ensure that any disclosure of 
information provided by that individual does not breach the 
duty of confidentiality. That said, a public authority should not 
agree to hold information in confidence where it is not 
appropriate to do so. 
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e The local authority should disclose personal data about their 
officials to Mr Abalone unless they have identified a specific 
risk. Mr Jones has already identified himself to Mr Abalone, 
and the personal data about the two officials only details their 
professional, public activities; there is nothing particularly 
private about it. This means that disclosing personal data 
relating to the two officials to Mr Abalone would not breach 
the data protection principles. In particular, the disclosure 
would be fair because both officials are in a public-facing role 
and are normally expected to identify themselves to members 
of the public. 


If Mrs Belshaw makes a subject access request: 


e Even though the two documents are held in a file listed under 
Mrs Belshaw’s name, this does not mean that all of the 
information they contain is Mrs Belshaw’s personal data. 


e Only the information in the first document (highlighted in 
green) that identifies Mrs Belshaw as the complainant is her 
personal data and the local authority should provide it to her. 


e As matters progress, the focus of the local authority’s 
investigation becomes Mr Abalone and his property. This 
means that even though the file is listed under Mrs Belshaw, 
most of its content is personal data about Mr Abalone. This is 
reflected in the two documents above, which only contain one 
brief, incidental reference to Mrs Belshaw. 


If the local authority receives an EIR request for any 
information it holds about littering in the Long Street area: 


e The local authority has to decide whether releasing the 
personal data in these documents under FOIA or the EIR 
breaches the data protection principles — in particular whether 
there is a legitimate interest in the disclosure which overrides 
the rights and freedoms of any data subject. Most of the 
information is personal data about Mr Abalone and it unlikely 
there will be a legitimate interest in releasing this information 
to the general public. Furthermore, some of the data is special 
category data, and there is unlikely to be a condition for 
processing this data. There is also no legitimate interest in 
releasing information identifying Mrs Belshaw as the 
complainant. 
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e However, there is a legitimate interest in releasing personal 
data detailing the activities of the council officials and 
information describing the mess at Mr Abalone’s property; 
anyone walking down Long Street would be aware of this 
anyway. In this case the legitimate desire of other residents 
to know what the council is doing about Mr Abalone’s mess 
might therefore lead the authority to release certain de- 
personalised information about the issue. 


e The authority should give consideration to whether they can 
redact certain information so that an individual is no longer 
identifiable. This will not be possible in all cases. 
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